Log invalid authentication attempts by user profiles with a password of *NONE

IBM i should be enhanced to log invalid sign-on attempts made against user profiles configured with PASSWORD(*NONE), and these attempts should be handled in a manner consistent with other failed authentication events. Today, these attempts are effectively ignored from an auditing and intrusion-detection perspective, which can create a blind spot in security monitoring and may prevent administrators from detecting targeted attacks against known user profiles.In addition, the current behavior on 5250 sign-on can disclose that a user profile exists by returning messaging that indicates the password is *NONE. This behavior should be changed so that the response is obfuscated, consistent with other invalid sign-on failures, and does not reveal whether the issue was an invalid user profile, invalid password, or a profile configured with PASSWORD(*NONE).Suggested outcomes -Log these events in the audit journal as failed authentication attempts, preferably as PW entry type P.Allow repeated attempts against PASSWORD(*NONE) profiles to contribute to intrusion-detection logic and generate IM audit journal entries when thresholds or attack patterns warrant it.Obfuscate sign-on failure messaging so that the system does not reveal that the targeted profile exists or that it is configured with PASSWORD(*NONE).